[analyzer][docs] CSA release notes for clang-21 #154600

steakhal · 2025-08-20T19:42:51Z

The commits were gathered using:

git log --reverse --oneline llvmorg-20-init..llvm/main \
  clang/{lib/StaticAnalyzer,include/clang/StaticAnalyzer} | grep -v NFC | \
  grep -v OpenACC | grep -v -i revert | grep -v -i "webkit"

FYI, I also ignored Webkit changes because I assue it's fairly specific for them, and they likely already know what they ship xD.

I used the LLVM_ENABLE_SPHINX=ON and LLVM_ENABLE_DOXYGEN=ON cmake options to enable the docs-clang-html build target, which generates the html into build/tools/clang/docs/html/ReleaseNotes.html of which I attach the screenshots to let you judge if it looks all good or not.

The commits were gathered using: ```sh git log --reverse --oneline llvmorg-20-init..llvm/main \ clang/{lib/StaticAnalyzer,include/clang/StaticAnalyzer} | grep -v NFC | \ grep -v OpenACC | grep -v -i revert | grep -v -i "webkit" ``` FYI, I also ignored Webkit changes because I assue it's fairly specific for them, and they likely already know what they ship xD. I used the `LLVM_ENABLE_SPHINX=ON` and `LLVM_ENABLE_DOXYGEN=ON` cmake options to enable the `docs-clang-html` build target, which generates the html into `build/tools/clang/docs/html/ReleaseNotes.html` of which I attach the screenshots to let you judge if it looks all good or not.

llvmbot · 2025-08-20T19:43:22Z

@llvm/pr-subscribers-clang

@llvm/pr-subscribers-clang-static-analyzer-1

Author: Balazs Benics (steakhal)

Changes

The commits were gathered using:

git log --reverse --oneline llvmorg-20-init..llvm/main \
  clang/{lib/StaticAnalyzer,include/clang/StaticAnalyzer} | grep -v NFC | \
  grep -v OpenACC | grep -v -i revert | grep -v -i "webkit"

FYI, I also ignored Webkit changes because I assue it's fairly specific for them, and they likely already know what they ship xD.

I used the LLVM_ENABLE_SPHINX=ON and LLVM_ENABLE_DOXYGEN=ON cmake options to enable the docs-clang-html build target, which generates the html into build/tools/clang/docs/html/ReleaseNotes.html of which I attach the screenshots to let you judge if it looks all good or not.

Full diff: https://github.com/llvm/llvm-project/pull/154600.diff

1 Files Affected:

(modified) clang/docs/ReleaseNotes.rst (+85-5)

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index f4f7dd8342d92..a8fd4b174cf7c 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -1198,8 +1198,6 @@ Code Completion
 
 Static Analyzer
 ---------------
-- Fixed a crash when C++20 parenthesized initializer lists are used. This issue
-  was causing a crash in clang-tidy. (#GH136041)
 
 New features
 ^^^^^^^^^^^^
@@ -1223,20 +1221,99 @@ New features
 - Implemented `P2719R5 Type-aware allocation and deallocation functions <https://wg21.link/P2719>`_
   as an extension in all C++ language modes.
 
+- Added support for the ``[[clang::assume(cond)]]`` attribute, treating it as
+  ``__builtin_assume(cond)`` for better static analysis. (#GH129234)
+
+- Introduced per-entry-point statistics to provide more detailed analysis metrics.
+  Documentation: :doc:`analyzer/developer-docs/Statistics` (#GH131175)
+
+- Added time-trace scopes for high-level analyzer steps to improve performance
+  debugging. Documentation: :doc:`analyzer/developer-docs/PerformanceInvestigation`
+  (#GH125508, #GH125884)
+
+- Enhanced the ``check::BlockEntrance`` checker callback to provide more granular
+  control over block-level analysis.
+  `Documentation (check::BlockEntrance)
+  <https://clang.llvm.org/doxygen/CheckerDocumentation_8cpp_source.html>`_
+  (#GH140924)
+
+- Added a new experimental checker ``alpha.core.FixedAddressDereference`` to detect
+  dereferences of fixed addresses, which can be useful for finding hard-coded memory
+  accesses. (#GH127191)
 
 Crash and bug fixes
 ^^^^^^^^^^^^^^^^^^^
 
+- Fixed a crash when C++20 parenthesized initializer lists are used.
+  This affected a crash of the well-known lambda overloaded pattern.
+  (#GH136041, #GH135665)
+
+- Dropped an unjustified assertion, that was triggered in ``BugReporterVisitors.cpp``
+  for variable initialization detection. (#GH125044)
+
 - Fixed a crash in ``UnixAPIMisuseChecker`` and ``MallocChecker`` when analyzing
   code with non-standard ``getline`` or ``getdelim`` function signatures. (#GH144884)
 
+- Fixed crashes involving ``__builtin_bit_cast``. (#GH139188)
+
+- ``__datasizeof`` (C++) and ``_Countof`` (C) no longer cause a failed assertion
+  when given an operand of VLA type. (#GH151711)
+
+- Fixed a crash in ``CastSizeChecker``. (#GH134387)
+
+- Some ``cplusplus.PlacementNew`` false positives were fixed. (#GH150161)
+
 Improvements
 ^^^^^^^^^^^^
 
+- Added option to assume at least one iteration in loops to reduce false positives.
+  (#GH125494)
+
 - The checker option ``optin.cplusplus.VirtualCall:PureOnly`` was removed,
-  because it had been deprecated since 2019 and it is completely useless (it
-  was kept only for compatibility with pre-2019 versions, setting it to true is
-  equivalent to completely disabling the checker).
+  because it had been deprecated since 2019. (#GH131823)
+
+- Enhanced the ``StackAddrEscapeChecker`` to detect more cases of stack address
+  escapes, including return values for child stack frames. (#GH126620, #GH126986)
+
+- Improved the ``BlockInCriticalSectionChecker`` to recognize ``O_NONBLOCK``
+  streams and suppress reports in those cases. (#GH127049)
+
+- Better support for lambda-converted function pointers in analysis. (#GH144906)
+
+- Improved modeling of ``getcwd`` function in ``StdCLibraryFunctions`` checker.
+  (#GH141076)
+
+- Enhanced the ``EnumCastOutOfRange`` checker to ignore ``[[clang::flag_enum]]``
+  enums. (#GH141232)
+
+- Improved handling of structured bindings captured by lambdas. (#GH132579, #GH91835)
+
+- Fixed unnamed bitfield handling in ``UninitializedObjectChecker``. (#GH132427, #GH132001)
+
+- Enhanced iterator checker modeling for ``insert`` operations. (#GH132596)
+
+- Improved ``format`` attribute handling in ``GenericTaintChecker``. (#GH132765)
+
+- Added support for ``consteval`` in ``ConditionBRVisitor::VisitTerminator``.
+  (#GH146859, #GH139130)
+
+- Enhanced handling of C standard streams in internal memory space. (#GH147766)
+
+- Enhanced store management with region-store-binding-limit to improve performance.
+  See `region-store-max-binding-fanout
+  <https://clang.llvm.org/docs/analyzer/user-docs/Options.html#region-store-max-binding-fanout>`_
+  config option. Overriding these options are discouraged, unless you know what you do.
+  (#GH127602)
+
+- Updated undefined assignment checker (``core.uninitialized.Assign``) diagnostics
+  to avoid using the term ``garbage``. (#GH126596)
+
+- Fixed false memory leak reports involving placement new. (#GH144341)
+
+- Avoided unnecessary super region invalidation in ``CStringChecker``.
+  (#GH146212, #GH143807)
+
+- Enhanced handling of tainted division-by-zero error paths. (#GH144491)
 
 Moved checkers
 ^^^^^^^^^^^^^^
@@ -1246,6 +1323,9 @@ Moved checkers
   checker ``alpha.security.ArrayBound`` (which was searching for the same kind
   of bugs with an different, simpler and less accurate algorithm) is removed.
 
+- Moved checker ``alpha.core.FixedAddressDereference`` out of the ``alpha`` package
+  to ``core.FixedAddressDereference ``. (#GH132404)
+
 .. _release-notes-sanitizers:
 
 Sanitizers

steakhal · 2025-08-20T19:45:10Z

I had limited time, so I used LLM to generate this. Exercise extra scrutiny during review.

There is an unrelated section about Type-aware allocation and deallocation functions that I'll move somewhere more appropriate later. The generated html would look like this then:

Xazax-hun · 2025-08-21T09:37:25Z

Looks good to me. Are all of those crashes present in previously released stable versions?

clang/docs/ReleaseNotes.rst

steakhal · 2025-08-21T12:02:18Z

Looks good to me. Are all of those crashes present in previously released stable versions?

To the best of knowledge yes. I also checked that no entries refer to commits that are only present on main.
(Well, there were two, that are now in the backport pipe)
I also excluded new feature crashes, such as the assume handling crashes, because that's new feature; thus it was never released.

You can spotcheck this though.

steakhal · 2025-08-21T12:05:16Z

This PR is blocked by #154608

necto · 2025-08-21T15:04:54Z

clang/docs/ReleaseNotes.rst

@@ -1246,6 +1323,9 @@ Moved checkers
  checker ``alpha.security.ArrayBound`` (which was searching for the same kind
  of bugs with an different, simpler and less accurate algorithm) is removed.


Suggested change

of bugs with an different, simpler and less accurate algorithm) is removed.

of bugs with a different, simpler and less accurate algorithm) is removed.

I decided to drop the whole second part of the sentence. I don't think it adds much value. If anything, only confuses people.
fff9d58

necto · 2025-08-21T15:06:01Z

clang/docs/ReleaseNotes.rst

+- Added a new experimental checker ``alpha.core.FixedAddressDereference`` to detect
+  dereferences of fixed addresses, which can be useful for finding hard-coded memory
+  accesses. (#GH127191)


Later in "Moved Checkers" it is mentioned to be moved to stable:

Moved checker alpha.core.FixedAddressDereference out of the alpha package
to core.FixedAddressDereference. (#GH132404)

Should these two entries be combined?

Great observation. Combined in a1a1d10

balazske · 2025-08-22T12:47:27Z

clang/docs/ReleaseNotes.rst

+- Added support for ``consteval`` in ``ConditionBRVisitor::VisitTerminator``.
+  (#GH146859, #GH139130)
+
+- Enhanced handling of C standard streams in internal memory space. (#GH147766)


Suggested change

- Enhanced handling of C standard streams in internal memory space. (#GH147766)

- C standard streams are no longer invalidated by all C library function calls. (#GH147766)

balazske · 2025-08-22T12:49:24Z

clang/docs/ReleaseNotes.rst

+
+- Added a new experimental checker ``core.FixedAddressDereference`` to detect
+  dereferences of fixed addresses, which can be useful for finding hard-coded memory
+  accesses. (#GH127191, #GH132404)


This checker should not be called "experimental" if it is not an alpha checker.

steakhal added this to the LLVM 21.x Release milestone Aug 20, 2025

steakhal requested review from necto, Xazax-hun, haoNoQ, balazske and NagyDonat August 20, 2025 19:42

steakhal added the clang:static analyzer label Aug 20, 2025

github-project-automation bot added this to LLVM Release Status Aug 20, 2025

github-project-automation bot moved this to Needs Triage in LLVM Release Status Aug 20, 2025

llvmbot added the clang Clang issues not falling into any other category label Aug 20, 2025

tru approved these changes Aug 21, 2025

View reviewed changes

github-project-automation bot moved this from Needs Triage to Needs Merge in LLVM Release Status Aug 21, 2025

tru moved this from Needs Merge to Needs Review in LLVM Release Status Aug 21, 2025

Xazax-hun approved these changes Aug 21, 2025

View reviewed changes

github-project-automation bot moved this from Needs Review to Needs Merge in LLVM Release Status Aug 21, 2025

steakhal mentioned this pull request Aug 21, 2025

[Analyzer] No longer crash with VLA operands to unary type traits #154738

Open

steakhal commented Aug 21, 2025

View reviewed changes

clang/docs/ReleaseNotes.rst Outdated Show resolved Hide resolved

Drop trailing space from link

767fe4d

necto approved these changes Aug 21, 2025

View reviewed changes

steakhal added 2 commits August 22, 2025 10:37

Drop irrelevant parts

fff9d58

Combine sections about FixedAddressDereference

a1a1d10

balazske reviewed Aug 22, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[analyzer][docs] CSA release notes for clang-21 #154600

[analyzer][docs] CSA release notes for clang-21 #154600

Uh oh!

steakhal commented Aug 20, 2025

Uh oh!

llvmbot commented Aug 20, 2025 •

edited

Loading

Uh oh!

steakhal commented Aug 20, 2025

Uh oh!

Xazax-hun commented Aug 21, 2025

Uh oh!

Uh oh!

steakhal commented Aug 21, 2025

Uh oh!

steakhal commented Aug 21, 2025

Uh oh!

necto Aug 21, 2025

Uh oh!

steakhal Aug 22, 2025

Uh oh!

necto Aug 21, 2025

Uh oh!

steakhal Aug 22, 2025

Uh oh!

balazske Aug 22, 2025

Uh oh!

balazske Aug 22, 2025

Uh oh!

Uh oh!

		@@ -1246,6 +1323,9 @@ Moved checkers
		checker ``alpha.security.ArrayBound`` (which was searching for the same kind
		of bugs with an different, simpler and less accurate algorithm) is removed.

	of bugs with an different, simpler and less accurate algorithm) is removed.
	of bugs with a different, simpler and less accurate algorithm) is removed.

	- Enhanced handling of C standard streams in internal memory space. (#GH147766)
	- C standard streams are no longer invalidated by all C library function calls. (#GH147766)

[analyzer][docs] CSA release notes for clang-21 #154600

Are you sure you want to change the base?

[analyzer][docs] CSA release notes for clang-21 #154600

Uh oh!

Conversation

steakhal commented Aug 20, 2025

Uh oh!

llvmbot commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steakhal commented Aug 20, 2025

Uh oh!

Xazax-hun commented Aug 21, 2025

Uh oh!

Uh oh!

steakhal commented Aug 21, 2025

Uh oh!

steakhal commented Aug 21, 2025

Uh oh!

necto Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

steakhal Aug 22, 2025

Choose a reason for hiding this comment

Uh oh!

necto Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

steakhal Aug 22, 2025

Choose a reason for hiding this comment

Uh oh!

balazske Aug 22, 2025

Choose a reason for hiding this comment

Uh oh!

balazske Aug 22, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

llvmbot commented Aug 20, 2025 •

edited

Loading